anonhaven
Ad

CVE-2026-29146

HIGH CVSS 3.1: 7.5 EPSS 0.10%
Updated Apr 10, 2026
Oracle
Parameter Value
CVSS 7.5 (HIGH)
Affected Versions 9.0.13 — 9..115
Fixed In 11.0.19
Type CWE-642, CWE-209 (Information Exposure Through Error Message)
Vendor Oracle
Public PoC No

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-642
CWE-209 Information Exposure Through Error Message

References 2

https://lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w
security@apache.org
http://www.openwall.com/lists/oss-security/2026/04/09/24
af854a3a-2127-422b-91ae-364da2661108
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-40193

Oracle

8.2

CVE-2026-5504

Oracle

6.3

CVE-2026-39974

Oracle

8.5

CVE-2026-35187

Oracle

7.7

CVE-2026-34595

Oracle

5.3